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This is in response to the appeal brief filed on 02/28/2007 appealing from the Office 
action mailed on 01/10/2005. 



Application/Control Number: 09/850,202 



Art Unit: 2141 



Page 2 



(1) Real Party in Interest 

A statement identifying by name the real party in interest is contained in the brief. 

(2) Related Appeals and Interferences 

The examiner is not aware of any related appeals, Interferences, or judicial 
proceedings which will directly affect or be directly affected by or have a bearing on the 
Board's decision in the pending appeal. 

(3) Status of Claims 

The statement of the status of claims contained in the brief is correct. 

(4) Status of Amendments After Final 

The appellant's statement of the status of amendments after final rejection 
contained in the brief is correct. 

(5) Summary of Claimed Subject Matter 

The summary of claimed subject matter contained in the brief is correct. 

(6) Grounds of Rejection to be Reviewed on Appeal 

The appellant's statement of the grounds of rejection to be reviewed on appeal is 
correct. 
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(7) Claims Appendix 

The copy of the appealed claims contained in the Appendix to the brief is correct. 

(8) Evidence Relied Upon 

6,308,148 Bruins et al. 10/2001 

6,587,878 Merriam 07/2003 



(9) Grounds of Rejection 

1. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or 
described as set forth in section 102 of this title, if the differences between the subject 
matter sought to be patented and the prior art are such that the subject matter as a 
whole would have been obvious at the time the invention was made to a person having 
ordinary skill in the art to which said subject matter pertains. Patentability shall not be 
negatived by the manner in which the invention was made. 



2. Claims 1-19, and 26-32 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Bruins et al (US Patent 6,308,148) in view of Merriam (US Patent 
6,587,878). 



3. Claim(s) 1, 10, 19, 28: Bruins teaches a method to monitor a network by a 
network monitor, comprising: 



Application/Control Number: 09/850,202 Page 4 

Art Unit: 2141 

receiving data packet flow records from at least one network router (Bruins, col. 
2, lines 23-24; wherein the router is collecting flow information to be used); 

filtering said flow records (Bruins, col. 2, lines 36-40); and 

extracting packet information from said filtered flow records (Bruins, col. 3, lines 
66-67) or from at least a fraction of said received flow records (Bruins, col. 2, lines 35- 
45; wherein the fraction of said received flow records is the subset of total set of flows), 
wherein said extracted packet information comprises information of at least one target 
of interest (Bruins, col. 4, lines 9-17; wherein the target of interest is the selected range 
of source addresses that originate from the internet domain "cisco.com" or in the second 
case, the target of interest is the selected protocol type such as the "FTP" protocol). 

Bruins, however, does not explicitly teach performing active measurements of 
said at least one target of interest based on said extracted packet information. Bruins 
does, however, suggest adjusting features or parameters based on aggregated flow 
information of the network to improve performance (Bruins, Abstract and Claim 5). 

Merriam, in an analogous art, teaches a performance measurement program to 
measure actual performance data (Merriam, col. 5, lines 29-31 and col. 9, lines 45-50). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to combine Bruins' method of extracting packet information from the filtered 
flow records with Merriam's performance measurement program to measure actual 
performance data extracted from the filter. One of ordinary skill in the art would 
recognized that the combination of exporting Bruin's network flow data with Merriam's 
performance measurement program would improve network performance or make the 
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network perform more efficiently (Bruins, Abstract and Claim 5, Bruins teaches 
improving performance of the router by modifying performance parameter of the router 
based on the aggregated message flow information. In addition, Merriam, col. 3, lines 
1-19 and col. 5 line 66 to col. 6 line 16, Merriam teaches measuring and using actual 
performance time information to fix unacceptable delays). 

4. Claim(s) 2, 11: Bruins and Merriam teach the method according to claim 1,10, 
said filtering step comprising: selecting flow records based on packet routing 
information in said received flow records (Bruins, col. 2, lines 24-25). 

5. Claim(s) 3, 12: Bruins and Merriam teach the method according to claim 2, 11, 
said filtering comprising selecting flow records having non-local destination or source 
addresses (Bruins, col. 3, lines 21-23; wherein the destination are host from the 
"internet" which implies non-local and local hosts. It is well known in the art that a 
method can filter flow records that have source and/or destination host from a local 
subnet or other subnets) . 

6. Claim(s) 4, 13: Bruins and Merriam teach the method according to claim 2, 11, 
said filtering comprising selecting flow records having local destination or source 
addresses (Bruins, col. 3, lines 21-23; wherein the destination are host from the 
"internet" which implies non-local and local hosts. It is well known in the art that a 
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method can filter flow records that have source and/or destination host from a local 
subnet or other subnets). 

7. Claim(s) 5, 14: Bruins and Merrlam teach the method according to claim 2,11, 
said filtering step comprising: selecting flow records having destination or source 
addresses associated with performing critical services (Bruins, col. 2, lines 28-32 and 
col. 3, lines 25-39; wherein the critical servers are file transfer, electronic mail, and http 
services). 

8. Claim(s) 6, 15: Bruins and Merriam teach the method according to claim 1,10, 
said filtering step comprising randomly selecting flow records from said received flow 
records (Bruins, col. 2, lines 36-38; wherein each filter randomly selects only a subset of 
the total flows). 

9. Claim(s) 7, 8, 16, 17, 26, 27: Bruins and Merriam teach the method according to 
claim 1, 10, 19, said active measurement comprise a ping and a traceroute process 
(Official Notice is taken of active measurement comprise ping and traceroute process. 
It is well known in the art at the time of the invention to use these processes in active 
measurement of network performance. It is also state in Merriam in col. 1 , lines 60-61). 

10. Claim(s) 9, 18: Bruins and Merriam teach the method according to claim 1,10, 
further comprising selecting the nature of said active measurements based on said 
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target of interest (Merriam, col. 5, lines 29-31 and col. 9, lines 45-50 and FIG. 1, ref. 
Server probe and remote probes). 

11. Claim(s) 29, 30, 31, 32: Bruins and Merriam teach the method according to 
claim 1, 10, 19, 28 further comprising: routing said data packets through said at least 
one router (Bruins, col. 2, lines 20-21; wherein the function of a router is to route data 
packets through its interfaces); and generating said data packet flow records (Bruins, 
col. 2, lines 23-24; wherein the router is collecting or generating flow information to be 
used. Flow information are information about data packets). 

(10) Response to Arguments 

(I) Applicant argues that there would not have been any motivation for one of 
ordinary skill in the art to combine the teachings of Bruins and Merriam to teach or 
suggest applicant's claimed invention. 

As to point (I), in rejecting claim 1 , Examiner stated that Bruins teaches a method 
to monitor a network by a network monitor, comprising: 

receiving data packet flow records from at least one network router (Bruins, col. 
2, lines 23-24; wherein the router is collecting flow information to be used); 

filtering said flow records (Bruins, col. 2, lines 36-40); and 

extracting packet information from said filtered flow records (Bruins, col. 3, lines 
66-67) or from at least a fraction of said received flow records (Bruins, col. 2, lines 35- 
45; wherein the fraction of said received flow records is the subset of total set of flows), 
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wherein said extracted packet information comprises information of at least one target 
of interest (Bruins, col. 4, lines 9-17; wherein the target of interest is the selected range 
of source addresses that originate from the internet domain "cisco.com" or in the second 
case, the target of interest is the selected protocol type such as the "FTP" protocol). 

Bruins, however, does not explicitly teach performing active measurements of 
said at least one target of Interest based on said extracted packet information. Bruins 
does, however, suggest adjusting features or parameters based on aggregated flow 
information of the network to improve performance (Bruins, Abstract and Claim 5). 

Merriam, in an analogous art, teaches a performance measurement program to 
measure actual performance data (Merriam, col. 5, lines 29-31 and col. 9, lines 45-50). 

It would have been obvious to one of ordinary skill in the art at the time of the 
invention to combine Bruins' method of extracting packet information from the filtered 
flow records with Merriam's performance measurement program to measure actual 
performance data extracted from the filter. One of ordinary skill in the art would 
recognized that the combination of exporting Bruin's network flow data with Merriam's 
performance measurement program would improve network performance or make the 
network perform more efficiently (Bruins, Abstract and Claim 5, Bruins teaches 
improving performance of the router by modifying performance parameter of the router 
based on the aggregated message flow information. In addition, Merriam, col. 3, lines 
1-19 and col. 5 line 66 to col. 6 line 16, Merriam teaches measuring and using actual 
performance time information to fix unacceptable delays). 

Examiner recognizes that obviousness can only be established by combining or 
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modifying tlie teachings of tlie prior art to produce tlie claimed invention wliere tliere is 
some teacliing, suggestion, or motivation to do so found eitlier in the references 
themselves or in the knowledge generally available to one of ordinary skill in the art. 
See In re Fine, 837 F.2d 1071, 5 USPQ2d 1596 (Fed. Cir. 1988)and In re Jones, 958 
F.2d347, 21 USPQ2d 1941 (Fed. Cir 1992). In this case, Examiner stated that "It 
would have been obvious to one of ordinary skill in the art at the time of the invention to 
combine Bruins' method of extracting packet information from the filtered flow records 
with Merriam's performance measurement program to measure actual performance 
data extracted from the filter. One of ordinary skill in the art would recognized that the 
combination of exporting Bruin's network flow data with Merriam's performance 
measurement program would improve network performance or make the network 
perform more efficiently." The motivation is from the teachings of Bruins and Merriam. 
In the abstract and Claim 5 of Bruins, Bruins teaches improving performance of the 
router by modifying performance parameter of the router based on the aggregated 
message flow information. Moreover, in col. 3, lines 1-19 and col. 5, line 66 to col. 6, 
line 16, Merriam teaches measuring and using actual performance time information to 
fix unacceptable delays. 

(11) Related Proceeding(s) Appendix 

No decision rendered by a court or the Board is identified by the examiner in the 
Related Appeals and Interferences section of this examiner's answer. 

For the above reasons, it is believed that the rejections should be sustained. 
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Respectfully submitted, 
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